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DETAILED ACTION 

This application has been examined. Claims 1-20 are pending. 

Priority 

This application claims benefit of priority from EPO Application 00480102.3 
dated November 14, 2000. 

Acknowledgment is made of applicant's claim for foreign priority under 35 
U.S.C. 1 19(a)-(d). Receipt is acknowledged of papers submitted under 35 
U.S.C. 1 19(a)-(d), which papers have been placed of record in the file. 

The effective date of the subject matter of the claims in this application is 
November 14, 2000. 

Information Disclosure Statement 



The information disclosure statement (IDS) submitted on March 7, 2002 is in 
compliance with the provisions of 37 CFR 1 .97. Accordingly, the information disclosure 
statement is being considered by the examiner. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-12, 14, and 16-20 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Levi (US Patent 6636983) in view of Rowland (US Patent 6405318). 

With respect to Claim 1 , Levi discloses a method comprising: enabling 
surveillance of a computer-like device connected to a communications network, said 
communications network including a Network Surveillance Server (NSS), (Column 3 
Lines 55-65, Column 4 Lines 1-40) said method including the steps of: upon joining 
said communications network, said computer-like device logging-in to said NSS; 
(Figures 2-4, Column 8 Lines 10-65) said NSS polling, said computer-like device while 
connected on said communications network, (Column 12 Lines 30-55) said NSS 
issuing an alarm, from, to a central surveillance unit if said computer-like device fails 
responding to polling; (Column 32 Lines 20-65, Column 33 Lines 1-30) and allowing 
said computer-like device to be watched by said NSS while being connected to said 
communications network. 
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With respect to Claim 2, Levi discloses the method according to claim 1 , wherein 
there are a plurality of more than one said NSS present in said communications 
network. (Column 5 Lines 40-50) 

With respect to Claim 3, Levi discloses the method according to claim 2, said 
step of said computer-like device logging-in includes the steps of: upon joining said 
communications network, (Column 12 Lines 20-50) discovering at least one said NSS 
within said communications network [305]; selecting one of said at least one NSS to 
perform the surveillance of said computer-like device [310]; (Column 5 Lines 40-45) 
sending credentials to said selected NSS; (Column 12 Lines 35) thereby, if accepted by 
said selected NSS [315], completing log-in; however, if not accepted [316], aborting log 
in. (Column 12 Lines 45) 

With respect to Claim 4, Levi discloses the method according to claim 1 , said 
step of polling includes the step of: said NSS checking if said computer-like device 
responds. (Column 32 Lines 30-35) 

With respect to Claim 6, Levi discloses a method according to claim 4, wherein 
said polling step includes collecting information about said computer-like device and a 
registered user of said computer-like device. (Column 8 Lines 10-65) 
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With respect to Claim 8, Levi discloses the method according to claim 1 , wherein 
said collecting step and said comparing step are performed on top of said polling step 
and said checking step. (Column 32 Lines 55-65, Column 33 Lines 1-40) 

With respect to Claim 9, Levi discloses a method according to claim 1, wherein 
said communications network is an IP network and said polling step utilizes the IP 
TING' command. (Column 32 Lines 40-60) 

Wth respect to Claim 10, Levi discloses a method according to claim 1, wherein 
said communications network is an IP network and said polling step utilizes the IP 
Address Resolution Protocol (ARP). (Column 32 Lines 40-60) 

With respect to Claim 1 1 , Levi discloses a method according to claim 1 , wherein 
said computer-like device is a mobile device. (Figure 1 1 , Column 20 Lines 40-60) 

With respect to Claim 12, Levi discloses a method according to claim 1, wherein 
said computer-like device is voice enabled. (Figure 11, Column 20 Lines 40-60) 

With respect to Claim 14, Levi discloses a method according to claim 1, wherein 
said collected information about said computer-like device includes: a current 
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geographic location; and an identification of a portal through which said communications 
network is accessed. (Column 6 Lines 25-60) 

With respect to Claim 16, the Applicant claims a network surveillance system for 
carrying out the method according to Claim 1. Claim 16 is rejected on the same basis 
as Claim 1. 

With respect to Claim 17, the Applicant claims a computer-like readable medium 
for carrying out the method according to Claim 1 . Claim 17 is rejected on the same 
basis as Claim 1 . 

With respect to Claim 18, the Applicant claims an article of manufacture for 
carrying out the method according to Claim 1 . Claim 18 is rejected on the same basis 
as Claim 1 . 

With respect to Claim 19, the Applicant claims a program storage device 
readable by machine for carrying out the method according to Claim 1 . Claim 1 9 is 
rejected on the same basis as Claim 1 . 
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With respect to Claim 20, the Applicant claims a computer program product for 
carrying out the method according to Claim 16. Claim 20 is rejected on the same basis 
as Claim 1 and 16. 

However Levi does not disclose certain features described by the Applicant. 

With respect to Claim 1 , Levi does not disclose of the method of Claim 1 
comprising of said computer-like device logging-out from said NSS prior to leaving said 
communications network; 

With respect to Claim 5, Levi does not disclose a method according to claim 1 , 
said step of said computer-like device logging-out includes the steps of: upon willing to 
leave said communications network, said computer-like device sending credentials to 
said selected NSS, thereby, if log-out is accepted by said NSS stops polling, said 
computer-like device thus, completing log-out; however, if log-out is not accepted, said 
NSS keeps polling, said computer-like device thus failing to complete log-out. 

With respect to Claim 7, Levi does not disclose a method according to claim 4, 
wherein said step of checking if said computer-like device responds, includes 
comparing if said collected information matches records, in said NSS, about said 
computer-like device and said registered user. 
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Rowland discloses an intrusion detection system that monitors the user behavior 
in real time and compares said behavior according to a previously determined user 
profile indicating said user's normal behavior. (Column 2 Lines 40-65, Column 7 Lines 
40-55) In addition to session monitoring, Rowland discloses of users logging out, and 
of a logout anomaly detector that would indicate if the user has logged off normally or 
otherwise, and issues alerts to the network administrator if any abnormal conditions are 
found. (Figures 1-5B, Column 5 Lines 40-65, Column 12 Lines 50-65) The logout 
anomaly detector includes polling the network device to determine the status of the 
logout process. (Column 10 Lines 50-55) 

Levi and Rowland are analogous art because they present concepts and 
practices regarding network monitoring for detecting abnormal activity in a network 
device. The Examiner respectfully suggests that it would have been obvious to a 
person of ordinary skill in the art to combine the teachings of Rowland into the method 
of Levi , such that 1) the user is enabled to complete a logout process and such that the 
system is enabled to detect an abnormal logout condition, and 2) the method of Levi is 
able to compare real-time user behavior with previously established normal behavior. 
The suggested motivation for doing so would be, as Rowland suggests, by comparing 
the user behavior to the dynamically built user profile, false alarms for abnormal activity 
(such as a device being incorrectly tagged as 'stolen' due to abnormal logout 
conditions) are reduced. (Rowland Abstract) 
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Thus it would have been obvious to combine the teachings of Rowland into the 
method of Levi in order to obtain the invention as described in Claims 1-12, 14, and 
16-20. 

Claims 13 and 15 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Levi (US Patent 6636983) in view of Rowland (US Patent 6405318) as applied to 
Claims 1-12, 14, and 16-20 above, and further in view of Lambert et al. (US Patent 
6367016), hereinafter referred to as Lambert . 

While the combined teachings of Levi and Rowland , when applied together, are 
enough to substantially disclose the invention as described in Claims 13 and 15, the 
combination of Levi and Rowland do not disclose the collection of biometric and 
personal credentials as follows: 

With respect to Claim 13, a method according to claim 1 , wherein said collected 
information about said registered user includes: a typing speed over a keyboard; a voice 
intonation. 

With respect to Claim 15, a method according to 1 , claim, wherein said 
credentials includes: knowing a personal identification number (PIN); knowing a 
password; and possessing a token or smartcard. 
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Lambert discloses of a method of controlling access to a network comprising of 
collecting biometric data in addition to the combination of passwords, PINs and 
smartcards in order to verify the identity and determine the access level of the user. 
Lambert uses various machine readers to collect said user information. (Column 3 
Lines 25-50, Column 4 Lines 50-60) 

Levi , Rowland and Lambert are analogous art because they present concepts 
and practices regarding collection of unique or secret personal information from the user 
for network and device security purposes. The Examiner respectfully suggests that it 
would have been obvious to a person of ordinary skill in the art to combine the 
teachings of Lambert into the combined teachings of Levi and Rowland . The said 
combination would allow the user validator of Levi (Column 12 Lines 35-45) to permit 
entry upon verifying static logon credentials such as passwords and PINs. Furthermore 
the said combination would allow for collection of real-time information pertaining to 
user behavior, such as typing speed and voice intonation, for comparison with 
previously determined behavioral patterns. The suggested motivation for doing so 
would be, as Lambert suggests, to take advantage of smartcard technology which by 
incorporating within it active data processing and storage facilities, provides security 
and flexibility. (Column 1 Lines 25-40) 



Application/Control Number: 10/035,724 Page 11 

Art Unit: 2144 

Therefore it would have been obvious to combine the teachings of Lambert into 
the combined methods of Levi and Rowland in order to arrive at the invention 
described in Claims 13 and 15. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Please refer to the enclosed PTO-892 form. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Greg Bengzon whose telephone number is (571 ) 272- 
3944. The examiner can normally be reached on Mon. thru Fri. 8 AM - 4:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, William Cuchlinski can be reached on (571)272-3925. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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SUPERVISORY PATENT EXAMINER 
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